Valkey 8.1.11 → 9.0.1

2 releases · 0 breaking changes · 2 security fixes · 0 advisories fixed

2security0breaking0deprecated0feature17fix

Breaking changes

None in the release notes.

security Fixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply in 9.0.0
security Fixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message in 9.0.0

fixAuthenticate slot migration client on source node to internal user (#2785)

fixBug fix: reset io_last_written on c->buf resize to prevent stale pointers (#2786)

fixSentinel: fix regression requiring "+failover" ACL in failover path (#2780)

fixCluster: Avoid usage of light weight messages to nodes with not ready bidirectional links (#2817)

fixSend duplicate multi meet packet only for node which supports it in mixed clusters (#2840)

fixFix: LTRIM should not call signalModifiedKey when no elements are removed (#2787)

fixFix build on some 32-bit ARM by only using NEON on AArch64 (#2873)

fixFix deadlock in IO-thread shutdown during panic (#2898)

fixFix COMMANDLOG large-reply when using reply copy avoidance (#2652)

fixFix CLUSTER SLOTS crash when called from module timer callback (#2915)

securityFixes CVE-2025-67733: RESP Protocol Injection via Lua error_reply

securityFixes CVE-2026-21863: Remote DoS with malformed Valkey Cluster bus message

fixHSETEX with FXX should not create an object if it does not exist (#2716)

fixFix crash when aborting a slot migration while child snapshot is active (#2721)

fixFix double MOVED reply on unblock at failover (#2734)

fixFix memory leak with CLIENT LIST/KILL duplicate filters (#2362)

fixFix incorrect accounting after completed atomic slot migration (#2749)

fixFix Lua VM crash after FUNCTION FLUSH ASYNC + FUNCTION LOAD (#1826, #2750)

fixFix invalid memory address caused by hashtable shrinking during safe iteration (#2753)